Vpn usage to create wide area network backbone over the internet

ABSTRACT

A wide area network using the internet as a backbone utilizing specially selected ISX/ISP providers whose routers route packets of said wide area network along private tunnels through the internet comprised of high bandwidth, low hop-count data paths. Firewalls are provided at each end of each private tunnel which recognize IP packets addressed to devices at the other end of the tunnel and encapsulate these packets in other IP packets which have a header which includes as the destination address, the IP address of the untrusted side of the firewall at the other end of the tunnel. The payload sections of these packets are the original IP packets and are encrypted and decrypted at both ends of the private tunnel using the same encryption algorithm using the same key or keys.

CLAIM OF PRIORITY

This application is Continuation of U.S. application Ser. No.14/614,302, filed Feb. 4, 2015, which in turn is a continuation of U.S.application Ser. No. 14/022,838, filed Sep. 10, 2013 (now U.S. Pat. No.9,015,471), which in turn is a Continuation of U.S. application Ser. No.11/942,616 filed Aug. 19, 2007 (now U.S. Pat. No. 8,595,478), which inturn is a Continuation of U.S. application Ser. No. 11/299,110, filedDec. 9, 2005 (now U.S. Pat. No. 7,318,152), which in turn is aContinuation of U.S. application Ser. No. 09/613,004 filed Jul. 10, 2000(now U.S. Pat. No. 7,111,163). The entire content of each of these priorapplications is incorporated herein by reference.

FIELD OF USE AND BACKGROUND OF THE INVENTION

The invention is useful in providing wide area networking services toclients with many locations among which data, especially high volumes ofdata, must be sent.

The prior art of WANs include frame relay and point-to-point networkingoffered by telephone companies. One type of Wide Area Network (WAN)service provided by telephone companies is leased lines. These may beanalog or digital and are provide typically by a Local Exchange Carrier(LEC) on an intraLATA basis (Local Access and Transport Area). InterLATAleased lines are also available but must be provided by an lnterexchangeCarrier (IXC) with the LEC providing the local loop connection.

Another such WAN service is known as a Virtual Private Network. A VPN isintended for use by very large organizations with multiple locations. AVPN appears to the user as if it was private leased line trunk network,but it is not. VPN services are generally arranged with an lnterexchangeCarrier (IXC) with the points of the network termination (locations fromwhich data will be sent and received being identified along with thelevel of bandwidth required at each termination. Dedicated circuits(telephone lines) are established between each network termination andthe closest capable IXC POP (Point of Presence). Connections betweenPOPS are not dedicated but are established by routers using routingtables to route the traffic over specified high-capacity transmissionfacilities on a priority basis to ensure the level of service providedis adequate and equivalent to a true private network using leased lines.

Other forms of Public Data Networks include: DDS, Switched 56 Kbps;Digital T-Carrier Systems; Digital 800 Services; X.25 Packet SwitchedServices; Broadband Data Networking such as Frame Relay and CellSwitching, ADSL, HDSL, Sonet, Switched Megabit Data Services, ISDN andAdvanced Intelligent Networks.

Dataphone Digital Service (DDS) which was introduced by AT&T in 1974 andis generally end-to-end, fully digital, dedicated service provided mymost carriers. DDS may be either point-to-point or multipoint. A headend Front End Processor controls all access to the network by pollingremote devices. All communication must pass through the head end. DDSsignals are carried within logical channels on T1 lines.

Switched 56 Kbps is a circuit switched (rather than dedicated line)digital service that serves the same applications as DDS although it ismore cost effective for lower data volumes. All the components are thesame as DDS but digital local loops and digital carrier exchanges areused. The main difference over DDS is that traffic is routed using alogical address which is the equivalent of a voice telephone number. Thecircuit is set up, maintained and torn down much like a voice call isswitched and pricing is similar. The cost is sensitive to distance,duration, time of day and day of the year.

Digital T-carrier systems (including fractional T1 service) arededicated links carry digital data over multiple logical channels on asingle physical communication circuit with the logical channelsestablished by time division multiplexing.

Digital 800 service was introduced in 1994 by AT&T and is intended formedium to high volume customers subscribing to high volume 800 serviceofferings.

X.25 packet switching was invented in the early 60's and was implementedon ARPANET in 1971. X.25 is a dial up service as is ISDN and Switched56/64 Kbps WANS, and, as such, is not suitable for dedicated WANs suchas the WANs in the AlterWAN™ network genus of the invention. The basicconcept of packet switching provides a highly flexible, shared networkin support of interactive computer communications in a WAN. Prior topacket switching, users spread over a wide area with only infrequenttraffic had no cost effective way of sharing computer resources.Asynchronous communications are bursty in nature and send only smallamounts of data with lots of idle time between bursts. Having dedicatedlines for such communication is a waste of bandwidth and expensive.Packet switching solved those problems by providing connections asneeded which were billed on the number of packets transmitted. Packetswitching also improved the error performance. Typically a packetswitched network uses a dial up connection to a packet switching node.Once the connection to packet switching node is made, a control packetis sent to establish the session with the target host. The controlpacket is forwarded across the most direct link that is available in anumber of hops between nodes. The target host responds with a controlpacket sent back to the source to establish the session. Each packet isnumbered sequentially and transmitted. ISDN is an entirely digital suiteof dial-up data communication services delivered over the twisted pairlocal loop. ISDN lines have B channels that carry information,D-channels that carry data for signaling and control, H-channels thatcarry high speed data for bandwidth intensive applications. It has beena commercial failure.

Frame relay networks were first deployed in the mid 90's and aresomewhat like packet switching in that each frame is individuallyaddressed. Frame relay makes use of special switches and a sharednetwork of very high speed. Unlike packet switching, frame relaysupports the transmission of virtually any computer data stream. Framesare variable in length up to 4096 bytes. Frame relay is data orientedand does not support voice or video very well. As is the case for X.25packet switching, frame relay overhead is high and delays intransmission are expected. Further, network congestion can result inloss of data. Although frame relay networks appear to the customer to beone-hop networks, they really are not one hop nets. There are many linksbetween multiple Central Office (CO) switches inside the typical framerelay cloud. Each hop adds latency and the possibility of running intobandwidth congestion. Further, frame relay networks cannot crosstelephone company boundaries so all sites on a frame relay WAN must beusing the same frame relay provider, i.e., it not possible for somesites to be coupled to AT&T frame relay COs and other sites to becoupled to MCI or Sprint COs. Every frame has a DLCI code in the headerthat identifies the customer and the virtual data path through aparticular telephone company for the traffic. Therefore, it is notpossible to mix frames with different DLCIs because different telcoDLCIs have different formats and that will disrupt the routing processfor such frames through the CO switches. If two locations on a framerelay network cannot both be served by the same frame relay provider, asecond frame relay cloud must be built and the two clouds connectedtogether by two routers at some common location that can be coupled toboth clouds with the two routers coupled together by a local areanetwork.

Cell switching has been conventionally thought to be the future of datacommunication networks. Cell switching encompasses both ATM networks andSwitched Multimegabit Data Service (SMDS). Data is organized into cellsof fixed length of 53 octets and are shipped across high speedfacilities and switched in high speed, specialized switches. ATM isprimarily data oriented, but is supports voice and video effectively.Cell switching is high cost and has high overhead and suffers from alack of fully developed standards. ATM networks are also not widelycommercially available yet.

The problem with all these approaches is that they are expensive withrecurring telephone company charges.

The internet as a backbone has recently loomed as a possibility forimplementing wide area networks and lowering the cost. However, thereare several problems with using the internet as a WAN backbone.Generally, these problems all relate to quality of service. Quality ofservice has to do with both errors in transmission as well as latency.Latency or delay on critical packets getting from source to destinationcan seriously slow or disrupt operations of computer systems. Latencycan also destroy the efficacy of streaming video, streaming audio andstreaming multimedia product and service delivery by causing visibleand/or audible gaps in the presentation of the program encoded in thedata to the user or freezes. This can be very distracting andundesirable in, for example, video conferences, video-on-demand,telephone calls etc. Latency is also a problem when large documents arebeing downloaded because it slows the process considerably. Latencyarises from multiple hops between nodes on the internet coupling thesource to the destination.

Prior art attempts to use the internet as a backbone did not control thenumber of hops and available bandwidth in the data path from source todestination. As a result the number of router hops along the route andthe lack of available bandwidth precluded the use of the internet as aviable private network backbone alternative. ISP's built localbusinesses without regard to the customers regional, national orinternational presence as their objective was only to offer LOCALinternet access. This resulted in attempts to use the internet as analternative private network backbone of routes that may have few hops ormany hops. Routes that may have inadequate bandwidth for the worst casebandwidth requirement of a WAN were sometimes picked and that resultedin failure. This uncontrolled hop count, and lack of control of the datapaths and the available bandwidth and the resulting latency causedproblems in implementing WANs on the internet.

Another major problem with using the internet as a backbone is securityor privacy. Since the internet is a public facility, private andsensitive data transmitted over the internet is subject to snooping.

Thus, there has arisen a need for a system which can use the internet asa WAN backbone to help decrease the costs of data transport while notsuffering from the aforementioned latency, privacy and bandwidthavailability problems.

SUMMARY OF THE INVENTION

The wide area network technology described herein (referred to asAlterWAN™ network) is an alternative wide area network that uses theinternet as a backbone with any telephone company providing the localloop connection to the first participating ISX/ISP and any telephonecompany providing a local loop connection from the endpointparticipating ISX/ISP to the destination router. This greatly reducesmonthly costs to customers and removes the frame relay restriction thatthe same telephone company must provide all data paths including thelocal loops at both ends. High quality of service is maintained bymimicking the “one hop” private network structures of prior art framerelay and point-to-point networks. Any WAN that uses the internet as abackbone and mimics the “one hop” structure of private frame relay andpoint-to-point networks by any means is within the genus of theinvention.

A key characteristic that all species within the genus of the inventionwill share is a tuning of the internet network routing process by properISX selection to reduce the hop count thereby reducing the latencyproblem that has plagued prior failed attempts to use the internet as aWAN backbone.

Another key characteristic that all species within the genus of theinvention will share is the transmission of secure encrypted data alongpreplanned high bandwidth, low hop-count routing paths between pairs ofcustomer sites that are geographically separated. The encrypted AlterWANdata is sent through a high bandwidth, dedicated local loop connectionto the first participating AlterWAN ISX/ISP facility. There, theAlterWAN packets are routed to the routers of only preselected ISXfacilities on the internet. The preselected ISX/ISP facilities are oneswhich provide high-bandwidth, low hop-count data paths to the otherISX/ISP facilities along the private tunnel. The routers of theseparticipating ISX/ISP facilities are specially selected to provide thesehigh-bandwidth, low hop-count data paths either by their natural routingtables or by virtue of special routing tables that these ISX/ISPproviders establish to route AlterWAN packets through high-bandwidth,low hop-count paths and route other internet traffic along other paths.For example, if a customer site in San Jose needs to have AlterWANservice to another site in Tokyo, a “private tunnel” is built in eachdirection through the internet and two dedicated local loops, one ateach end are established to connect the two customer sites to the firstand last participating ISX providers in the private tunnel. Datasecurity is implemented by the use of conventional or customfirewall/VPN technology. At each customer site, a firewall/VPN device isconfigured to securely encrypt the payload of each AlterWAN packet to besent through a “private tunnel” to the far end customer site where thepayload is decrypted. Using conventional firewalls, the encryptionmethod and the encryption keys used at both ends for transmissions inboth directions are the same. However, the invention also contemplatesusing one encryption algorithm and encryption key or keys for downstreamtransmissions and another encryption method and different key or keysfor the upstream direction. This method may require the use of customdesigned firewalls. Whichever method is used, the firewalls at both endsuse the same encryption method and key or keys for encryption of packetsat the source and decryption of them at the destination by predeterminedconfigurations that are programmed into the firewalls. Only packetsidentified at the source end firewall with a destination IP address atthe other end of an AlterWAN “private tunnel” have the payload of thepacket encrypted before being sent. Once they are encrypted, they aresent across the preplanned route to the destination where the far endfirewall recognizes the IP address of the packet as being addressed toit. Only those packets are decrypted and transmitted to the device towhich they are addressed and other packets that are not AlterWAN packetsare either rejected or routed to some other device which is not part ofthe AlterWAN network.

In other words, the quality of service problem that has plagued priorattempts is solved by providing non-blocking bandwidth (bandwidth thatwill always be available and will always be sufficient) and predefiningroutes for the “private tunnel” paths between points on the internetbetween ISX facilities. Participating ISX facilities agree to providenon-blocking bandwidth between their sites. By having private tunnels toeach location of a worldwide company for example, an engineer in SanJose can connect directly to a LAN at a branch office in Paris and “see”on his/her computer's desktop all the shared items on the Paris LAN suchas various servers, printers etc.

This preplanning of the routing path causes traffic from AlterWAN™customers to be transmitted quickly and without delay from end to endand not experience delays due to lack of bandwidth or excessive hopcount. Because the packet payload is encrypted, the data is secureduring its transport across the internet through the “private tunnel”.The AlterWAN™ network design minimize the number of hops each AlterWAN™network packet experiences in its travel from source to destinationthereby reducing latency by causing AlterWAN™ network traffic to berouted only over high bandwidth lines coupling participating ISX/ISPproviders. Recently, there has been a large amount of building of ISXinternet providers having fiber optic data paths to other providers toprovide large amounts of bandwidth. Typically, one or both of therouters at the source and destination of the AlterWAN™ network can beco-located at the first ISX.

The privacy problem is overcome by firewalls provided in the AlterWAN™network at every customer premises which are encrypting firewalls(preferred firewalls are commercially available from Netscreen). Everyoutgoing AlterWAN™ packet (AlterWAN packets are those packets which areencrypted and are transmitted along predefined routes through theinternet in “private tunnels”) is encrypted by the firewall at thesource using a preconfigured encryption algorithm although anyencryption algorithm such as conventional DES encryption that uses a keywill suffice. The encryption process requires the preprogramming of“private tunnel” identities and the associated encryption and decryptionkeys. The “key” is used by the firewall/VPN device for encryption anddecryption of the packet payload. Keys are preassigned for each “privatetunnel” and are generated by the firewalls at each end from one or twopasswords that are programmed into the firewall when the private tunnelis set up. Encrypted packets are routed over predefined paths. Packetsintended for the general internet are not encrypted and are passed outto the first ISX to find their way through the internet by the normalrouting process. Each packet that is intended for a predefined privatetunnel is encrypted and sent out through a dedicated high bandwidthlocal loop to the first ISX. From there it is routed along a predefinedroute established by proper selection of ISX providers.

The key can remain the same over time or change, but no packet encryptedwithout the current key for a particular tunnel can be decrypted at thedestination. The keys are never transmitted along the tunnels. They areconfigured into the firewalls by prearrangement at each end. Each tunnelhas a different key.

A “private tunnel” is defined as the data path through the internet fromthe source firewall to the destination firewall through the predefined,low hop count, high bandwidth path. The private tunnel is established byproper selection of ISX providers. This is done by studying the normalrouting paths used by all the ISX providers between a pair of customersites to be connected by the tunnel.

Then ISX providers which normally route along high bandwidth links witha minimum hop count are selected to participate. When AlterWAN packetsreach these ISX providers, the normal routing that occurs there resultsin the AlterWAN encrypted packets travelling along a high bandwidth lowhop count path.

The ability of firewalls to encrypt and decrypt is known andcommercially available and is simply being used in the AlterWAN network.Browsers at workstations at customer AlterWAN sites however can bepointed to any website on the internet and can send and receive packetsto and from those sites without restriction. Those packets are referredto herein as conventional packets, and they get to their destinations byconventional internet routing and do not pass through the privatetunnels created by the AlterWAN data structures.

The AlterWAN data structures really are just IP addresses and associateddata in the firewalls and routers along the tunnel that cause thepackets to travel the low hop count path. The AlterWAN data structureswill vary from customer to customer depending upon which sites are to belinked and the locations and IP addresses of the participating ISX/ISPproviders through which the hops of the private tunnel will pass.

Finally, all species in the genus of the invention will solve thebandwidth bottleneck that has plagued prior attempts to use the internetas a WAN backbone. This is done by implementing AlterWAN™ routingstrategies. An AlterWAN data path extends from a source router (having achannel service unit to interface between the packet world of routers tothe physical and media access control and/or signalling protocols of thetelephone line) through a sufficiently high bandwidth dedicated localloop line to the first participating ISX or Internet Service Provider(ISP) that is a participating provider of AlterWAN™ network services.From there it extends along a data path between other participating ISXproviders along a data path which is guaranteed to have sufficientbandwidth to be able to handle the worst case bandwidth consumption ofthe customer. In the claims, such an ISX or ISP provider is referred toas a “participating ISX/ISP”. All the ISX or ISP facilities that areparticipating in the AlterWAN™ network structure have fiber optic orother high bandwidth data paths such as OC3 or OC12 data paths availableto them to send data to other ISX/ISP facilities that are participatingin the AlterWAN^(TM) network. It is these high bandwidth links which arereferred to as “core bandwidth” between participating ISX/ISPfacilities. It is this core bandwidth over which AlterWAN™ “privatetunnel” traffic is routed on the internet backbone.

The dedicated lines from the source router at the customer premises tothe nearest participating ISX/ISP is typically T1 class or better inbandwidth, but it only needs to have two characteristics: it must bededicated and not dialup; and, it must have sufficient bandwidthcapacity to handle the worst case bandwidth consumption of theparticular client facility it serves. Such a line is referred to in theclaims as a “dedicated line”. Thus, the dedicated lines from the sourcerouter to the nearest participating ISX/ISP may also be DSL orfractional T1.

The “participating ISX/ISP” to which the “dedicated line” couples maynot be the nearest ISX/ISP since it is a rule of the AlterWAN™ networkto only choose ISX/ISP facilities that restrict the loads in their datapaths so as to have large amounts of spare bandwidth capacity. Forexample, AboveNet typically has loads of 50% or less in their highbandwidth data paths to other ISX facilities. Therefore, AlterWAN™network species will all have their dedicated connections to ISX/ISPfacilities that have lots of spare bandwidth capacity and definitelymore than the anticipated worse case bandwidth consumption of thecustomer so there is never a bandwidth bottleneck even if that ISX/ISPfacility is not the closest facility. Although the local loop costs willbe higher in such situations, the savings by using the internet as abackbone without quality of service problems will greatly outweigh theburden of higher local loop costs.

The use of the dedicated lines to the nearest participating ISX/ISP andselection of only ISX/ISP facilities that limit the traffic in theirdata paths so as to have a great deal of spare capacity are the twocharacteristics of all AlterWAN™ network species which solve the priorart bandwidth bottleneck problems.

The above described structure controls the three major unpredictabilityfactors that have frustrated prior workers in the art who have attemptedto use the internet to implement WANs: hop count, bandwidthavailability, and latency. The advantages of the AlterWAN™ networkstructure and operation are: large savings in Telco charges.; cleanimplementation of security not requiring PC or workstations to loadspecial client software; use of ISX core internet bandwidth withsufficient bandwidth available for worst case scenarios and with arobust fault tolerant infrastructure; the ability to offer full orpartial turn-key solutions to WAN needs; local loops may be a mix ofdifferent services and speeds from different providers; an apparent onehop route to each location; customer access to local router andfirewall; both public and private IP addressing can be used;communications are secure through secure tunnels using encryptedpackets; and no need to rely on quality of service software processes ateither end to get data, voice and video through since the AlterWANnetwork controls hop count, latency and bandwidth availabilityinherently by its structure and operation.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a WAN using the internet as a backboneaccording to the genus of the invention.

FIG. 2 is a block diagram of the actual hardware used in a typicalAlterWAN network.

FIG. 3 is a logical view of an AlterWAN private tunnel.

FIG. 4 is a block diagram of a typical AlterWAN network for a U.S.headquarters coupled to several international sites.

DETAILED DESCRIPTION OF THE PREFERRED AND ALTERNATIVE EMBODIMENTS

Typically 60-80% of wide area network costs over a five year period arerecurring telephone company charges for their frame relay andpoint-to-point networking services. These charges break down into: localloop charges to have the connection; a distance charge depending uponthe distances between nodes; and, a bandwidth charge for the minimumbandwidth the customer specifies. These costs can typically bedrastically reduced by using the internet as a WAN backbone, but only ifthe latency and other quality of service problems that have plaguedprior art attempts can be solved. These costs can be drastically reducedover frame relay and point-to-point networks even if extra costs ofcrossing telephone company boundaries are not incurred. The AlterWAN™network of the invention does not have any telephone company boundaryproblems to overcome.

Referring to FIG. 1, there is shown a block diagram of a wide areanetwork species within the genus of the wide area networks using theinternet as the backbone with controlled, small hop count, reducedlatency and adequate bandwidth for the worst case scenario. A workstation 10 (or server or any other peripheral) is typically coupled toan encrypting/decrypting firewall 12 by a local area network representedin this case by a LAN hub or switch 14. The work station 10 or otherdevice may also be coupled to the firewall 12 by a dedicated line inalternative embodiments, and there may be more than one workstation orother device coupled to the firewall 12 either by LAN 14 or byindividual dedicated lines. The preferred firewall is manufactured byNetscreen, but any encrypting/decrypting firewall that uses a customerdefined key to encrypt each AlterWAN™ packet that has an IP destinationaddress at the end of an AlterWAN private tunnel will suffice.

The function of the firewall, in one embodiment, is to receive andencrypt downstream packets addressed to nodes at the destination site onthe AlterWAN network and to receive conventional internet protocolpackets (hereafter IP packets) addressed to some other IP address on theinternet and distinguish them from AlterWAN packets and not encryptthem. Both AlterWAN and conventional IP packets are sent to the firewallfrom the workstation 10 or other peripherals at customer site 1, shownin dashed lines at 20. One function of the firewall 12 (and thecorresponding firewall 40 at the destination) is to distinguish betweenAlterWAN packets and conventional IP packets. AlterWAN packets are thosepackets which are addressed to destinations at the end of an AlterWANprivate tunnel. Conventional packets are IP packets addressed to anyother IP address other than an address at the other end of an AlterWANprivate tunnel. The firewall at each end of a private tunnel areconfigured to encrypt AlterWAN packet payloads and send them to a routerat the location of firewall from which they are converted to a suitablesignal format for transmission on a dedicated local loop connection andtransmitted to the first ISX/ISP provider along predefined highbandwidth, low hop-count private tunnel through the internet.Conventional IP packets are not encrypted and are sent to the router andon the same dedicated local loop connection to the first participatingISX/ISP where they are routed to their destinations without using theprivate tunnel high bandwidth, low hop-count route. The firewalls makethis distinction by examining the packet headers and using thedestination address information and one or more lookup tables todetermine which packets are AlterWAN packets addressed to nodes on theAlterWAN network and which packets are addressed to any other IP addressoutside the AlterWAN network.

More specifically, at each end of a private tunnel, a packet addressedto any of the IP addresses of devices at the other end of a privatetunnel are recognized as packets that need to be converted to AlterWANpackets, encrypted by the firewall and encapsulated in another IP packethaving as its destination address the IP address of the untrusted sideof the firewall at the other end of the private tunnel. The compositeAlterWAN packet is comprised of the encrypted original IP packet with anAlterWAN packet header which has as its destination address the IPaddress of the untrusted side of the destination firewall. At thefirewall at the other end, these incoming AlterWAN packets willrecognized because their destination addresses match the IP address ofthe untrusted side of the firewall. The firewall then strips off theAlterWAN packet header of the encapsulating packet and decrypts theoriginal IP packet that was encapsulated using the same encryptionalgorithm and key or keys that were used to encrypt it. The decryptedpacket then has an IP packet header which has a destination addresswhich matches the IP address of some device on the LAN on the trustedside of the destination firewall. The decrypted packet is then put onthe destination LAN and makes its way to the device to which it wasaddressed.

The main function of the firewall is to encrypt the payloads of onlyAlterWAN packets with customer defined key or keys which are configuredto be the same in the firewalls at both ends of the tunnel. In thepreferred embodiment, commercially available firewalls are used whichare configured to use the same encryption algorithm and encryption keysat both ends of each tunnel for packets travelling in either directionalong the tunnel. However, in alternative embodiments, firewalls may beused which use one encryption algorithm and set of one or moreencryption keys for packets travelling in one direction along the tunneland another different encryption algorithm and/or a different set ofkeys in the firewalls at each end of the tunnel for packets travellingin the opposite direction. The corresponding firewall/VPN device at thetunnel far end must be programmed with the exact same key used toencrypt the packet to decrypt the packet. The encrypted packet is testedwith the local key to decrypt the packet. If a match exists, the packetis decrypted and allowed through the firewall/VPN device. If not, it isdiscarded. Many firewalls set the encryption method and key the same forboth directions of a private tunnel. In the event a firewall/VPN deviceimplements a private tunnel by using a different encryption method andor key for each half of a private tunnel, and that both firewall/VPNdevices are configured properly, they may be implemented and used in anAlterWAN network solution. The key can be the same for all AlterWANpackets over time or it can change over time. Any encryption algorithmcapable of doing this will suffice. Any conventional IP packets are notencrypted by the firewall and are simply forwarded to a router such assource router 18 or destination router 42.

The firewalls 12 and 40 are typically coupled by another local areanetwork line to a router at the source or destination site. For example,firewall 12 is coupled by LAN line 16 to a router 18 at customer site 1,and firewall 40 is coupled by a LAN line 44 to destination router 42.Routers 18 and 42 each function to route AlterWAN and conventional IPpackets differently. Both routers 18 and 42 route any AlterWAN packetinto a “private tunnel” of a dedicated high bandwidth local loop datapath 22 which guides these AlterWAN packets to the first participatingISX/ISP 24 in the AlterWAN™ network. The first and last participatingISX/ISP providers also have channel service units represented by boxes23 and 25. Any conventional IP packets are also routed into dedicateddata path 22, but these conventional data packets are not part of theAlterWAN private tunnel because their destination addresses are not theaddress of the destination at the other end of the tunnel. Each ofrouters 18 and 42 includes a channel service unit, as shown at 19 and21. These channel service units convert the digital data of the packetsinto signals suitable for transmission on whatever type of dedicatedlocal loop signal path 22 and 46 are selected. The local loop dedicatedsignal paths 22 and 46 do not need to be the same type of signal path atboth ends so long as suitable channel service units or cable modems areselected for CSUs 19 and 21.

The dedicated line 22 is typically a T1 class, partial T1 or DSL line orbetter with adequate bandwidth in both directions to meet the worst casebandwidth consumption scenario. DSL lines are typically not preferredsince they typically only have about 640 Kbps bandwidth upstream to theCO even though they have 1.544 Mbps downstream or better. There arehowever some ADSL variations with up to 5 Mbps upstream and 51.84 Mbpsdownstream from the CO to the customer sites. One variant of ADSLsupports 15 Mbps upstream and 155 Mbps downstream, but the customer ADSLmodem must be within 500 meters of the central office so such a line ishighly impractical unless the AlterWAN customer site is virtually at theCO. Since the AlterWAN™ network is bidirectional and must havesufficient bandwidth on all data path segments thereof to meet the worstcase scenario, DSL lines typically cannot be used unless the worst casescenario does not exceed the DSL line upstream bandwidth specification.Also, for DSL lines, the CO must be within about 2 miles (0.6 to 1.2miles for the higher speed variants) from the customer site and thisrestriction can rule out their use if a deal with a participatingISX/ISP within that range cannot be made.

Each of routers 18 and 42 have a channel service unit (not separatelyshown) built into the router (or external). The function of thesechannel service units in the local loop is to electrically andphysically convert the (LAN) ethernet data to the signaling protocolsand signal format of the telco on whatever dedicated lines 22 and 46 arechosen. The dedicated lines can be different (telephone lines or hybridfiber coax of a CATV system or digital cable or satellite bidirectionallinks) and can be provided by different vendors. For example, if thededicated line 22 is a T1 line the channel service units converts theAlterWAN packet data into signaling compatible with the chosen telco andtransmission of that data to the matching CSU/router at the other end ofthe local loop where the signal is converted back to a format acceptablefor processing be the router at the ISX. If the dedicated line is thehybrid fiber coaxial digital cable of a CATV system using frequencydivision multiplexing or code division multiplexing or discretemultitone modulation, the channel service unit modulates the ethernetonto the proper FDMA carriers or spreads the spectrums for transmissionacross the “local loop” with the spreading codes dedicated to theAlterWAN connection. This interfacing is bidirectional between thesignal formats and protocols on dedicated lines 22 and 46

Routers 18 and 42 are the translators of the AlterWAN™ network privatetunnel. The routers translate from ethernet protocol to the telcoprotocol on the dedicated lines 22 and 46. Other conventional IP packetsthat reach router 18 are routed along the same physical path and thededicated lines but really are on a different logical path. Theirpayloads are not encrypted and they are not sent through the “privatetunnels”. AlterWAN packets addressed to different destinations will berouted into the proper private tunnels of the AlterWAN network set upfor those destinations. In some embodiments, conventional IP packetswill be blocked by router 18 from entering the private tunnel or anyother logical channel of the dedicated lines 22 and 46. Data path 26leaving router 18 is a DMZ path and is optional. Likewise, destinationrouter 42 includes a DMZ port 27. The DMZ path can be any other datapath that is not part of the AlterWAN network, and is typically wheremail servers reside.

One of the side effects of having the high speed dedicated line 22 isthat workstations at the client facility 1 (and the client facility atthe other end of the WAN) can also have high speed internet access toother websites that have nothing to do with the AlterWAN solutionwithout a separate connection. The AlterWAN traffic on dedicated line 22shares this transport with non-AlterWAN traffic so it is important thatthe bandwidth on this dedicated local loop meet the aggregate needs ofboth AlterWAN traffic and conventional traffic. As part of this process,packets that are not AlterWAN packets are recognized by the firewall bylooking at the addressing information in packet header information andare not encrypted. Conversely, packets that appear to the firewall to beaddressed to nodes in the AlterWAN network have their packet payloadsencrypted. All the packets are then sent to the source router 18 (ordestination router 42) which routes them. Conventional packets getrouted on dedicated line 22 other than the AlterWAN private tunnel tothe first participating ISX/ISP 24. At the first ISX/ISP 24 in theAlterWAN network, these conventional packets get routed out one of thedata paths represented by lines 27 through 36 that couple router 24 tothe rest of the internet. This provides high speed access to other webpages and websites and e-mail services as a byproduct of the AlterWANhardware and software processing.

AlterWAN packets get routed at the first ISX/ISP 24 into a highbandwidth data path 50 to the next participating ISX/ISP 48 in theAlterWAN network. Data path 50 is selected for the AlterWAN packets bythe preselected ISX/ISP and peer level predefined routing betweenparticipating ISX/ISP's. This allows AlterWAN traffic to be transportedbetween locations utilizing the naturally existing routes but thoseroutes are selected so as to be high bandwidth and low hop count. Eachrouter in the participating ISX/ISP facilities connects and communicatesin the same fashion. AlterWAN networks, by design, require selection ofthe ISX/ISP partners for any given network based on many factorsincluding the ease of implementation by utilizing naturally occurring orother existing high bandwidth, low hop count routes. AlterWAN designerspretest these routes by performing a minimum of a ping test andtraceroute test to verify the path data that AlterWAN packets will takethrough the private tunnel that is to be implemented as an AlterWANconnection. AlterWAN partners do not normally need to add specialroutes, but implementing AlterWAN network designs that follow existingknown paths does not preclude the addition of special routing from timeto time as needed to afford better routing. By such a process, anAlterWAN network does not require each participating ISX/ISP to makealterations to their equipment for each “private tunnel” created butrather transparently utilizes the high bandwidth peer level connectionsbetween ISX/ISP's. However, the invention does not preclude use ofISX/ISP providers who have altered their routing tables so as to insurethat AlterWAN packets get routed along high bandwidth, low hop-countdata paths while non-AlterWAN packets get routed along other data paths.Participating ISX/ISP's are selected in part based on their ability touse these natural routes to form low hop count connections between theends of an AlterWAN private tunnel or by entering into a special dealwith one or more other participating ISX/ISP's to implement specialpeering arrangements and/or routing between each other to allow onlyAlterWAN traffic to use these special low hop count high bandwidthconnections forcing non AlterWAN traffic to follow other natural routingthat does not provide the bandwidth and or hop counts that meet theAlterWAN requirement.

In the example of FIG. 1, only three participating ISX/ISP providers areshown at 24, 48 and 54. The high bandwidth paths are the naturallyoccurring data paths that result from the routing tables in theparticipating ISX provider routers. These data paths are represented bylines 50 and 56. The private tunnel between customer site #1 at 20 andcustomer site #2 at 58 is implemented by the dedicated lines 22 and 46and the high bandwidth data paths 50 and 56 selected for AlterWANpackets by the routing tables in participating ISX/ISP providers 24, 48and 54.

When AlterWAN packets from customer site #1 reach endpoint ISX/ISProuter 54, they are routed onto dedicated line 46 to the channel serviceunit of destination router 42. The destination router 42 recovers andreassembles the ethernet packets and outputs them to firewall 40.Firewall 40 decrypts all AlterWAN packets with its local matching keypreconfigured on the firewall/VPN device and formats them to the LANprotocol. It then forwards them to the destination LAN hub or switch 60where they are sent out on LAN 62 addressed to whatever peripheral 64,66 or 68 to which they are destined. AlterWAN packets from any of theseperipherals addressed to any of the peripherals at customer site #1, 20,are encrypted by firewall 40 and are routed back through the privatetunnel to site 20 where they are decrypted by firewall 12 and forwardedto LAN hub or switch 14 and sent out on LAN 70 to whatever peripheral atsite 20 to which they are addressed.

Firewall and Tunnel Setup

The firewalls 12 and 40 can be any commercially available firewall withthe ability to create a virtual private network. The firewalls serve twogeneral purposes: they provide general security from unwanted access tothe AlterWAN customer LAN network; and they provide private encryptedtunnels between a known set of sites even though the internet is apublic facility. Each customer's AlterWAN network will be differentbased upon their needs in terms of the type and bandwidth of dedicatedlines used and the private tunnel data paths set up through theparticipating ISX/ISP providers between customer sites.

The interfaces of a firewall consist of an untrusted WAN interface, oneor more trusted IP interfaces to dedicated lines or LAN drop lines, anda DMZ interface (if available). These three interfaces are illustratedat 72, 74 and 76, respectively, in FIG. 2 which is a block diagram ofthe actual hardware configuration of a typical AlterWAN network. Theuntrusted or WAN interface is used to interface to the ISX/ISP premisesrouter of the public internet, optionally through a customer premisesrouter 18 or 42. The IP trusted interface interfaces to the customer'sprivate local area network 70 or 62 (or to dedicated lines to eachperipheral in some embodiments). The DMZ interface (optionally availableon some firewalls) is used to configure a separate network where devicesthat may need both public and private access typically are placedincluding WEB servers and e-mail servers.

Every LAN and WAN interface at both the customer premises and theISX/ISP in FIG. 2 needs to be configured with IP addresses. Theexception to this would be any LAN using a protocol different thanethernet IP such as Token Ring. In such case the proper networking andconversion equipment would be required. Each interface to be configuredin general includes: an IP address, for example 204.123.111.150; anetwork mask, for example 255.255.255.0; and a default gateway, forexample 204.123.111.1. The addressing for each interface is eithersupplied by the ISX/ISP or by the customer. The telephone (or cablesystem operator) high bandwidth dedicated lines 22 and 46 need to be inplace and operational in addition to the configurations mentioned aboveto complete the AlterWAN structure.

Tunnels and encryption methods vary between manufacturers of firewallsand virtual private network (hereafter VPN) equipment. This limits theability to mix products from different manufacturers within a specificcustomer's AlterWAN setup because the firewalls/VPN process at each endof each tunnel must use the same encryption algorithms so AlterWANpackets can be properly encrypted and decrypted. If however, allfirewalls from all manufacturers can be modified to use the sameencryption algorithm, then firewalls/VPN processes from differentmanufacturers can be mixed and matched. The VPN processing hardware andsoftware to encrypt and decrypt AlterWAN packets can be integrated intothe firewall or external to it.

A virtual private network tunnel requires the following basic componentsand data structures at each end of the tunnel. There must be a virtualprivate network process running on a VPN processor (can be the sameprocessor as the firewall processor) or external to a firewall on eachend of the private tunnel. The untrusted address of the far end VPNuntrusted WAN interface must be configured in the VPN configuration datastructure at each end including a mnemonic label, an IP address and anetwork mask. The VPN configuration data structure at each end must alsoinclude a mnemonic label, an encryption key, an encryption type, anencryption password, and the gateway IP address of the far end firewalluntrusted or WAN interface. Only when a VPN pair configured in thismanner exists with one VPN on each end of a proposed tunnel, and theparticipating ISX/ISP providers route a path between the two endpointsover high bandwidth links with a minimum number of hop for AlterWANpackets, does the private tunnel actually exist. Once the tunnel iscreated, all the conventional internet routers and uncontrolled numberof hops and uncontrolled latency that they create for non AlterWANpackets virtually disappear for AlterWAN packets. The AlterWAN data pathlogically appears to be a direct point-to-point connection between thetwo sites at opposite ends of the tunnel as shown in FIG. 3.

Private tunnels are defined for each customer based upon the needs ofthat customer. This is done by identifying a set of known participatingISX/ISP locations through which the number of known hops caused by theirrouters is minimized. All locations on the internet outside this knownset of sites and the associated networks are assumed to be generalinternet sites to which conventional IP packets can be directed.

The only real difference between a conventional IP packet and anAlterWAN packet is that the payload of the AlterWAN packet is encryptedConventional packets have no encryption performed on the packet payloadand are routed to the default gateway IP address of the participatingISP/ISX.

The firewalls at each end of each private tunnel prevent anyunauthorized user from accessing the private LANs of AlterWAN customers.The tunnels in each firewall have configuration data that only allowsspecific user traffic access to the private tunnels. Traceroutes to anyaddress outside the tunnel show all router hops for conventional packetswhile traceroutes to any address inside a private tunnel shown onlyprivate tunnel hops for AlterWAN traffic. The establishment of a privatetunnel enables users at a first customer site to appear to be directlyconnected to a LAN at another site of the customer so that all theshared resources on the other end of the tunnel appear on the desktopsof the workstations at the first site. Most of the participatingproviders in AlterWAN structures are ISX providers. This eliminates thenumerous hops customers typically incur in dealing with local ISPs forwide area networking. By picking participating ISX providers that havehigh bandwidth lines that are not fully utilized, the bandwidthavailability problem of using the internet as a WAN backbone is solved.Numerous ISX providers now offer 1-hop connections to major cities inthe U.S. and throughout the world. The AlterWAN network structure takesadvantage of this fact by selecting the ISX/ISPs that form the shortestpath(s) between the set of customer sites that need to communicate.Through this design and selection process, the natural routes thatstitch together these high bandwidth single hop lines with dedicatedhigh bandwidth local loops to geographically separated customer sites tocreate a private tunnel through the internet between any two customersites to provide frame relay quality service at substantially less cost.

Frame relay prior art WANs were considered highly desirable because theyestablish permanent virtual circuits with known paths having knownbandwidth. The internet has not been able to provide a similar solutionin the prior art. The AlterWAN network structure changes that bycreating virtual private circuits or tunnels through the internet usingonly lines that are known to have sufficient bandwidth to carry theworst case load and by minimizing the number of hops by using primarilyISX providers. Prior attempts to use the internet for WANs have failedbecause the data paths were not controlled, the bandwidth wasoversubscribed or in any fashion insufficient causing unacceptablelatency and delays. This caused unpredictable latency which is veryundesirable for multimedia video and audio traffic. Only light userswith small amounts of non time sensitive data were able to use theinternet successfully as a WAN. The AlterWAN network structure uses aset of known high bandwidth, usually fiber optic, links between majordomestic and international cities and couples these data paths withdedicated point-to-point or frame relay circuits run locally from the“nearest” participating ISX/ISP (sometimes it is not the physicallynearest ISX but is the nearest ISX with a high bandwidth line to a keycity that is participating) to the customer site. The unique aspects areforcing the participating routers to stitch together known highbandwidth data paths with a minimum number of hops to high bandwidthdedicated local loop connections and encrypting all AlterWAN traffic forprivacy.

FIG. 4 is block diagram of a typical AlterWAN network for aninternational corporation with multiple international locations in theU.K., Germany, France and Japan with a headquarters in the U.S. Supposeone of workstations 78 through 82 on LAN 84 in the U.K. site 96 wants tohave access to server 86 on LAN 88 at the U.S. headquarters.Workstations 78 generates an IP packet that gets encapsulated into anEthernet or other LAN packet addressed to the firewall 90. The firewalllooks up the IP address in its tables and determines that the packet isaddressed to an AlterWAN IP address in the U.S. headquarters. It thenencrypts the payload portion of the packet using the prearranged key forthe tunnel to the destination. The encrypted packet payload is sentthrough the “private tunnel” from the U.K. firewall 90 to the U.S. sitefirewall 92. Network address translation unit converts any IP addressesthat conflict with private IP addresses owned by some other company toone IP address on the untrusted interface given by the participatingISX. Firewalls can handle both NAT addressing and transparentaddressing, but that is not relevant to the invention.

After encryption, the AlterWAN packet is forwarded to router 98 at theU.K. site 96. This router examines every packet and based on the routingtables forwards packets to the next ISX. In this case, the router willonly receive packets from the firewall if they were not for the localLAN. At this time, AlterWAN packets and conventional IP packets areequal, but AlterWAN traffic has “designed in” efficient routing paths tothe destination points with the ISX/ISP connected by dedicated localloop line 100 that couples the router to the first participating ISXprovider within internet cloud 102 via a known internal or externalchannel service unit. The router in the first participating ISX withinthe internet cloud receives the AlterWAN packets and routes them alongthe predetermined private tunnel data path that has been preplanned touse the natural routing table (unless a special case requires additionalspecial routes). This process continues at each router of each ISX alongthe private tunnel to the U.S. site 106. The last participating ISXalong the private tunnel is represented by switch 104. This switch hasall AlterWAN packets destined for this location passing therethrough andmay be used to keep track of traffic levels for purposes of billing.Billing can be based on fixed monthly connections and/or billing with abase fee and usage fee. Collection of the information to generatebilling on base fee plus usage is from each location requiring such.

From switch 104, AlterWAN packets are routed to firewall 92 at thecustomer U.S. site where they are decrypted and sent to router 108 whichoutputs the packets onto LAN 88 where they are received and processed byserver 86. Non AlterWAN packets routed by switch 104 to firewall 110 areeither replies to general internet activity initiated on LAN 88 oroutside traffic requests intended for the web servers 114 and 116 on thefirewall DMZ. Any other traffic would be rejected by the firewall. Thesepackets are not encrypted, and after the firewall 110 processes them,they are routed to a LAN hub 112 and sent from there to a web server 114and another web server 116.

AlterWAN packets that originate at the U.K. or one of the otherinternational sites and are addressed to another international sitenever go to switch 104. Instead an IP packet originating at, forexample, the U.S. site and addressed to a device on the LAN at theFrench site, get routed through a private tunnel that extends from theU.K. firewall 90 to the French firewall 91. Thus, these packets neverpass through switch 104.

Although the invention has been disclosed in terms of the preferred andalternative embodiments disclosed herein, those skilled in the art willappreciate possible alternative embodiments and other modifications tothe teachings disclosed herein which do not depart from the spirit andscope of the invention. All such alternative embodiments and othermodifications are intended to be included within the scope of the claimsappended hereto.

Appendix A to U.S. Pat. No. 7,111,163 is a typical list of configurationcommands for the firewall at the headquarters site of a typical AlterWANto establish a private tunnel through the internet from the headquartersto a destination site firewall including establishment of the IP addressof the first ISX in the tunnel. Appendix B is a typical list ofconfiguration commands for the destination site firewall at the otherend of the private tunnel. Appendix C is a typical list of configurationcommands to configure the router at the headquarters site. Appendix D isa typical list of configuration commands to configure the router at thedestination site.

Although the invention has been disclosed in terms of the preferred andalternative embodiments disclosed herein, those skilled in the art willappreciate possible alternative embodiments and other modifications tothe teachings disclosed herein which do not depart from the spirit andscope of the invention. All such alternative embodiments and othermodifications are intended to be included within the scope of the claimsappended hereto.

I claim:
 1. A method of routing packets at a first machine associatedwith a first network, the packets originating from one or more thirdparty sources and destined for one or more third party destinations,each of the sources and destinations not being a part of the firstnetwork, the method comprising: receiving the packets; filtering thereceived packets to distinguish first packets which are to be associatedwith a virtual private network from second packets which are not to beassociated with the virtual private network; encapsulating the firstpackets; routing the encapsulated first packets via a dedicated lineconnection to a second machine associated with the first network, forforwarding of the first packets to the one or more third partydestinations; and routing the second packets exclusively over at leastone second connection, different than the dedicated connection, forforwarding to the one or more third party destinations.
 2. The method ofclaim 1, wherein receiving includes using a channel service unit toreceive the packets via a dedicated connection that directly links themachine with a network associated with a predetermined client.
 3. Themethod of claim 2, wherein filtering includes examining headerinformation of the received packets, comparing a network destinationaddress from said header information with a predetermined address, andidentifying the received packets as the first packets when the networkaddress matches the predetermined address.
 4. The method of claim 2,wherein filtering includes identifying a type of data conveyed by thereceived packets, associating the identified type of data with a qualityof service level, and identifying the received packets as the firstpackets when the quality of service level meets a threshold.
 5. Themethod of claim 1, wherein filtering includes examining headerinformation of the received packets, comparing a network address fromsaid header information with a list having at least one predeterminedaddress, identifying the received packets as the first packets when thenetwork address matches the predetermined address, and identifying thereceived packets as the second packets when the network address does notmatch any predetermined address in the list.
 6. The method of claim 1,wherein filtering includes determining whether the received packets areaccompanied by a mnemonic label corresponding to the virtual privatenetwork and, if the received packets are companied by the mnemoniclabel, identifying the received packets as the first packets.
 7. Themethod of claim 6, wherein the first machine is associated with a firstendpoint of the first network, wherein the second machine corresponds toa second endpoint of the first network, and wherein the mnemonic labelcorresponds to at least one first route that connects said firstendpoint with the second endpoint of the first network, wherein furtherthe second machine is to remove the encapsulation added by the firstmachine before forwarding of the first packets to the one or more thirdparty destinations.
 8. The method of claim 1, wherein: the receivedpackets are to be received as mixed traffic, comprising both the firstpackets and the second packets, from a first intermediary network; thesecond packets are to be exchanged by the first network with a secondintermediary network; and each of the first intermediary network, thesecond intermediary network and the first network is adapted to carrymixed Internet traffic between the one or more third party sources andthe one or more third party destinations.
 9. The method of claim 1,wherein: the first machine is associated with a first endpoint of thefirst network; the second machine corresponds to a second endpoint ofthe first network; the dedicated connection connects said first endpointwith the second endpoint of the first network; filtering includesexamining header information for received packets, comparing a networkdestination address from said header information with a predeterminedaddress outside of the first network, and identifying the receivedpackets as the first packets when the network destination addressmatches the predetermined address; and the second machine is to forwardpackets associated with the virtual private network from the firstnetwork to the network destination address.
 10. The method of claim 1,wherein filtering includes examining header information of receivedpackets, comparing a network destination address from said headerinformation with a predetermined destination address, and automaticallyidentifying the received packets as the first packets when the networkdestination address and a source of the received packets match apredetermined source-destination address pair.
 11. The method of claim1, wherein the method further comprises storing a first routing tableand at least one second routing table, wherein one or more routesidentified by the first routing table are mutually-exclusive to one ormore routes identified by the at least one second routing table, whereinrouting the encapsulated, first packets includes using only one or moreroutes of the first routing table to route the encapsulated, firstpackets, and wherein routing the second packets includes using only oneor more routes of the at least one second routing table.
 12. The methodof claim 1, wherein encapsulating the first packets includes encryptingthose packets using an encryption key corresponding to a decryption keyknown a priori to the destination associated with the first network. 13.The method of claim 1, wherein filtering includes identifying a type ofdata conveyed by the received packets, associating the identified typeof data with a quality of service level, and identifying the receivedpackets as the first packets when the quality of service level meets athreshold.
 14. An apparatus adapted for use in a first network, to routepackets the packets originating from one or more third party sources toone or more third party destinations, each of the sources anddestinations not being a part of the first network, the apparatuscomprising: means for receiving the packets; means for filtering thereceived packets to distinguish first packets which are to be associatedwith a virtual private network from second packets which are not to beassociated with the virtual private network; means for encapsulating thefirst packets; means for routing the encapsulated first packets via adedicated line connection to a second machine associated with the firstnetwork, for forwarding of the first packets to the one or more thirdparty destinations; and means for routing the second packets exclusivelyover at least one second connection, different than the dedicatedconnection, for forwarding to the one or more third party destinations.15. An apparatus comprising instructions stored on non-transitorymachine-readable media, the instructions when executed to cause at leastone processor in a first machine associated with a first network to:receive packets; filter the received packets to distinguish firstpackets which are to be associated with a virtual private network fromsecond packets which are not to be associated with the virtual privatenetwork; encapsulate the first packets; route the encapsulated firstpackets via a dedicated line connection to a second machine associatedwith the first network, for forwarding of the first packets to one ormore third party destinations; and route the second packets exclusivelyover at least one second connection, different than the dedicatedconnection, for forwarding to the one or more third party destinations;wherein the received packets originate from one or more third partysources and are addressed to the one or more third party destinations,and wherein each of the sources and destinations are not a part of thefirst network.
 16. The apparatus of claim 15, wherein the instructionswhen executed are to cause the at least one processor to obtain thereceived the packets from the one or more third party sources via achannel service unit, the channel service unit to directly link thefirst network to a network of a predetermined client, via a dedicatedconnection.
 17. The apparatus of claim 16, wherein the instructions whenexecuted are to cause the at least one processor to examine headerinformation of the received packets, compare a network destinationaddress from said header information with a predetermined address, andidentify the received packets as the first packets when the networkaddress matches the predetermined address.
 18. The apparatus of claim16, wherein the instructions when executed are to cause the at least oneprocessor to identify a type of data conveyed by the received packets,associate the identified type of data with a quality of service level,and identify the received packets as the first packets when the qualityof service level meets a threshold.
 19. The apparatus of claim 15,wherein the instructions when executed are to cause the at least oneprocessor to examine header information of the received packets, comparea network address from said header information with a list having atleast one predetermined address, identify the received packets as thefirst packets when the network address matches the predeterminedaddress, and identify the received packets as the second packets whenthe network address does not match any predetermined address in thelist.
 20. The apparatus of claim 15, wherein the instructions whenexecuted are to cause the at least one processor to determine whetherthe received packets are accompanied by a mnemonic label correspondingto the virtual private network and, if the received packets arecompanied by the mnemonic label, to identify the received packets asassociated the first packets.
 21. The apparatus of claim 20, wherein thefirst machine is associated with a first endpoint of the first network,wherein the second machine corresponds to a second endpoint of the firstnetwork, and wherein the mnemonic label corresponds to at least onefirst route that connects said first endpoint with the second endpointof the first network, wherein further the second machine is to removethe encapsulation added by the first machine before forwarding of thefirst packets to the one or more third party destinations.
 22. Theapparatus of claim 15, wherein: the received packets are to be receivedas mixed traffic, comprising both the first packets and the secondpackets, from a first intermediary network; the second packets are to beexchanged by the first network with a second intermediary network; andeach of the first intermediary network, the second intermediary networkand the first network is adapted to carry mixed Internet traffic betweenthe one or more third party sources and the one or more third partydestinations.
 23. The apparatus of claim 15, wherein: the first machineis associated with a first endpoint of the first network; the secondmachine corresponds to a second endpoint of the first network; thededicated connection connects said first endpoint with the secondendpoint of the first network; the instructions when executed are tocause the at least one processor to examine header information for thereceived packets, to compare a network destination address from saidheader information with a predetermined address outside of the firstnetwork, and to identify the received packets as the first packets whenthe network destination address matches the predetermined address; andthe specific destination is to forward packets associated with thevirtual private network from the first network to the networkdestination address.
 24. The apparatus of claim 15, wherein theinstructions when executed are to cause the at least one processor toexamine header information of the received packets, to compare a networkdestination address from said header information with a predetermineddestination address, and to automatically identify the received packetsas the first packets when the network destination address and a sourceof the received packets match a predetermined source-destination addresspair.
 25. The apparatus of claim 15, wherein the instructions whenexecuted are further to cause the at least one processor to: store afirst routing table and at least one second routing table, one or moreroutes identified by the first routing table being mutually-exclusive toone or more routes identified by the at least one second routing table;route the encapsulated, first packets using one or more routes of thefirst routing table, to the exclusion of each route of the secondrouting table; route the second packets using only one or more routes ofthe at least one second routing table, to the exclusion of each route ofthe first routing table.
 26. The apparatus of claim 15, wherein theinstructions when executed are further to cause the at least oneprocessor to encrypt the first packets using an encryption keycorresponding to a decryption key known a priori to the destinationassociated with the first network.
 27. The apparatus of claim 15,wherein the instructions when executed are further to cause the at leastone processor to identify a type of data conveyed by the receivedpackets, to associate the identified type of data with a quality ofservice level, and to identify the received packets as the first packetswhen the quality of service level meets a threshold.